fix: re-sign macOS binaries locally to prevent AMFI SIGKILL

macOS AMFI (Apple Mobile File Integrity) caches code signing validation
per-inode. Ad-hoc signatures created on CI runners can be cached as
invalid on user machines, causing SIGKILL (exit 137) with no crash
report. Re-signing locally after install/update refreshes the cache.

Applied to: install.sh, installBinary(), ReplaceSelf()

Author: ourines

install.sh

@@ -95,6 +95,14 @@ main() {
     tar -xzf "${TMPDIR}/${ARCHIVE}" -C "$TMPDIR"
     chmod +x "${TMPDIR}/${BINARY}"
 
+    # macOS: re-sign binary locally to avoid AMFI code signing cache issues
+    # CI signs on GitHub runners, but the ad-hoc signature may be cached as
+    # invalid by macOS AMFI on the user's machine, causing SIGKILL on launch.
+    if [ "$OS" = "darwin" ] && command -v codesign >/dev/null 2>&1; then
+        codesign --force --sign - "${TMPDIR}/${BINARY}" >/dev/null 2>&1
+        ok "Code signed for macOS"
+    fi
+
     # Try /usr/local/bin first, sudo if needed, fall back to ~/bin
     installed=false
     if [ -w "$INSTALL_DIR" ]; then

internal/commands/commands.go

@@ -553,6 +553,11 @@ func installBinary() (string, bool) {
 		return "", false
 	}
 
+	// macOS: re-sign to prevent AMFI SIGKILL on ad-hoc signed binaries
+	if runtime.GOOS == "darwin" {
+		exec.Command("codesign", "--force", "--sign", "-", installPath).Run()
+	}
+
 	ui.ShowSuccess("codes installed to %s", installPath)
 
 	if runtime.GOOS == "windows" {

internal/update/apply.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"runtime"
 	"time"
@@ -195,6 +196,7 @@ func ReplaceSelf(newBinaryPath string) error {
 			os.Remove(newBinaryPath)
 		}
 	}
+	codesignDarwin(self)
 	return nil
 }
 
@@ -281,3 +283,15 @@ func copyFile(src, dst string) error {
 	_, err = io.Copy(out, in)
 	return err
 }
+
+// codesignDarwin re-signs a binary with an ad-hoc signature on macOS.
+// This prevents SIGKILL from macOS AMFI (Apple Mobile File Integrity) which
+// can reject binaries whose code signing cache is stale or was created on a
+// different machine (e.g. CI runners).
+func codesignDarwin(path string) {
+	if runtime.GOOS != "darwin" {
+		return
+	}
+	cmd := exec.Command("codesign", "--force", "--sign", "-", path)
+	_ = cmd.Run() // best-effort; ignore errors
+}